Operating a digital-asset custody business without proper authorisation in the British Virgin Islands exposes a firm to enforcement action, disrupted banking relationships and the permanent loss of institutional counterparty access. The Virtual Asset Service Providers Act 2022 (the BVI VASP Act) brought custody of digital assets squarely within the regulated perimeter of the BVI Financial Services Commission (BVI FSC). Every firm holding, controlling or safeguarding virtual assets on behalf of clients must register or obtain a licence before operating – and the analysis turns sharply on where clients are based, not just where the entity sits.
This page maps the regulated basis for custody under the BVI VASP Act, walks through the authorisation process for an inbound business, addresses the cross-border tax and banking realities that shape the structure, and identifies the decision points that most frequently cause delays.
Why digital-asset custody is a regulated activity in the BVI
Custody of digital assets is a regulated activity under the BVI VASP Act because the FSC treats the safeguarding and administration of virtual assets on behalf of third parties as a service warranting direct supervision. The BVI FSC administers the VASP Act and has issued supplementary guidance on which custody models fall within scope. Any arrangement in which a BVI-registered entity holds private keys, controls settlement, or otherwise assumes responsibility for client assets meets the definition – regardless of whether the underlying technology is self-custody infrastructure, a multi-party computation scheme, or a traditional hot/cold wallet split.
The threshold question is not the legal form of the entity but the functional character of the activity. A BVI company that manages a sub-custody relationship for a fund, or that provides key-management services to a token issuer, falls within scope just as a full-service exchange custodian does. We regularly advise fund managers who assumed that a nominee arrangement kept them outside the perimeter; in most cases the FSC's functional analysis brings them back in.
The cross-border dimension matters immediately. A BVI entity serving clients in the European Union, the United Kingdom, Singapore or the United States must also assess whether its custody activity attracts regulation in those markets – under MiCA for EU-based clients, under the FCA's regime for UK clients, and under the relevant Payment Services Act provisions for Singapore. The BVI registration does not create a passport into any of those regimes. It establishes a home base, not a global licence.
What the BVI VASP Act covers for custody operators
The BVI VASP Act 2022 creates two broad tracks for virtual asset service providers: a registration track for lower-risk activities and a full licensing track for activities carrying higher risk to clients or the financial system. Custody is treated as a higher-risk activity, meaning an inbound business must seek a full VASP licence rather than simple registration. The distinction matters because the licensing track carries more demanding governance, capital and AML requirements.
The FSC expects a licensed custodian to demonstrate, at a minimum: a qualifying local presence, a fit and proper senior management team, adequate systems for safeguarding client assets (including segregation from proprietary assets), a documented AML/CFT programme aligned to FATF Recommendation 15 and the Travel Rule (the obligation to pass originator and beneficiary data with a virtual asset transfer), and an operational resilience framework covering key recovery and business continuity.
The requirement for a local presence does not mean a large back-office operation. But the FSC will not accept a brass-plate structure. A licensed custodian needs a director or compliance officer with genuine accountability in the BVI, and the board must demonstrate active oversight of the custody operations rather than rubber-stamp governance.
For practical purposes, custody authorisation in the BVI also involves ongoing regulatory reporting obligations. Licensed entities file periodic returns with the FSC and must notify the Commission of material changes in ownership, management, technology infrastructure, or the scope of services. Failing to notify is itself a breach – one we see cited in FSC enforcement correspondences more often than operators expect.
How does the BVI custody authorisation process work?
The BVI VASP licence application for a custody business follows a structured sequence governed by the FSC's published procedures under the VASP Act. The process begins with a pre-application engagement: operators submit a preliminary notification to the FSC, which enables the Commission to flag jurisdictional or structural concerns before a full application is filed.
The full application package includes corporate constitutional documents, a detailed business plan describing the custody model, key-management architecture and client onboarding procedures, fit-and-proper disclosures for all directors and beneficial owners, a compliance manual addressing AML/CFT and the Travel Rule, and evidence of the technical infrastructure underpinning the custody service. Completeness is material – the FSC's clock does not start until the application is deemed complete, and incomplete submissions are a leading cause of extended timelines.
Once the application is accepted as complete, the FSC conducts a substantive review. This includes an assessment of the principal officers, a review of the compliance framework, and – where the custody architecture is novel (for example, MPC-based or involving DeFi integrations) – a technical review that may involve external consultation. The overall authorisation timeline is not fixed by statute and varies with application quality and FSC workload; operators should plan for a process measured in months rather than weeks, and we advise clients to build that lead time into their product launch schedules.
In our practice, the applications that move most efficiently share two characteristics: the compliance documentation is complete and jurisdiction-specific (not repurposed from another hub), and the technical architecture description is written for a regulatory reader rather than an investor deck. Both are solvable with proper preparation.
Consider a scoped authorisation assessment before you file. The process above describes the standard path. Your facts – the entity structure, the client base, the custody model – change the analysis materially. For a pre-application review, contact OBOLUS at info@oboluslaw.com.
How does the BVI custody structure interact with tax and banking?
The BVI's principal tax advantage for a licensed custodian is the absence of corporate income tax, capital gains tax and withholding tax at the BVI level – but that benefit is only part of the picture for a business serving clients across multiple jurisdictions. The BVI itself does not impose tax on the entity; what matters is the tax treatment in the jurisdictions where the clients, the beneficial owners and the counterparties are located.
A BVI custodian holding assets for EU-based fund clients will encounter the OECD's Base Erosion and Profit Shifting framework, the EU's list of non-cooperative jurisdictions (which has historically included the BVI in various iterations), and the substance requirements that EU parent companies must satisfy. These are not insurmountable but they require deliberate structuring: a BVI entity that lacks substance will typically fail the economic activity tests applied by EU or UK parent entities, triggering controlled foreign corporation rules or transfer pricing adjustments at the operating group level.
Banking is a persistent operational challenge for BVI-licensed custody businesses. Correspondent banking access for a BVI entity depends heavily on the credibility of the regulatory authorisation. An FSC-licensed custodian with a documented AML programme and clean beneficial ownership disclosure has a materially better banking profile than an unregistered entity. In our cross-border practice, we have seen banking relationships open – and remain open – for BVI custody structures precisely because the FSC licence gave the corresponding bank confidence in the regulatory baseline. Conversely, structures built to minimise apparent substance tend to attract the most friction from banking compliance teams.
The interaction with the Travel Rule is also a cross-border variable. Where a BVI custodian transfers virtual assets to or from counterparties in FATF-compliant jurisdictions – including Singapore (MAS), the EU (MiCA's Travel Rule provisions) or the UK (FCA) – the data-sharing obligation applies to both sides of the transfer. The BVI custodian must have an operational Travel Rule solution before it sends or receives transfers involving counterparties in those regimes. This is no longer a compliance aspiration; it is an operational prerequisite.
How does the BVI compare to other custody hubs?
The BVI sits in a distinctive position among custody licensing options: it offers a common-law foundation, a well-developed corporate registry, and a regulatory authority with a defined VASP regime, at a cost and complexity level generally lower than ADGM or the DIFC, and with a more established international recognition profile than some newer regimes. That said, the comparison is never abstract – it depends entirely on the operator's client base, capital structure and banking relationships.
Against an EU base (for example, a CASP authorisation under MiCA), the BVI does not offer passporting into EU member states. A BVI custodian serving EU institutional clients must address the third-country regime in each relevant member state, which can mean additional legal analysis and, in some markets, a notification or supplementary registration obligation. For operators whose primary client base is in the EU, a MiCA CASP authorisation from a passporting jurisdiction will typically be more efficient.
Against Singapore (MAS, Payment Services Act), the BVI comparison turns on the target client geography and the importance of the Singapore banking ecosystem. MAS licensing carries its own timeline and capital requirements; the BVI is often faster and less capital-intensive. But Singapore's proximity to Asia-Pacific institutional flows and its banking infrastructure give MAS-licensed custodians an operational advantage for that client corridor.
Against the VASP regimes in the Cayman Islands (CIMA), the BVI compares favourably on recognition and legal familiarity in the institutional fund market. Both are common-law jurisdictions with British Overseas Territory status; the choice between them often turns on where the fund structure above the custodian is domiciled.
The core question for an inbound operator is whether the BVI licence, combined with a banking-friendly structure and a credible AML programme, supports the actual client and counterparty relationships the business needs. We map that analysis across the licence, banking and tax dimensions as a single mandate.
If a prior application stalled or a banking relationship closed unexpectedly, a structural review can identify the cause. Contact OBOLUS at info@oboluslaw.com to discuss the options.
What mistakes do custody applicants most commonly make in the BVI?
The most frequent error we observe in BVI custody applications is the use of compliance documentation drafted for a different jurisdiction – often an EU or Singapore submission – with superficial adaptation. The BVI FSC has its own expectations regarding the structure of an AML programme, the depth of key-management disclosure, and the format of the business plan. A submission that reads like it was written for ESMA will prompt requests for further information and extend the timeline significantly.
A second recurring problem is underestimating the fit-and-proper assessment. The FSC reviews not only criminal and regulatory history but the professional track record of proposed directors in digital-asset businesses specifically. Appointing a nominee director with no operational involvement in the custody business is unlikely to satisfy the FSC's substantive review. The Commission expects the individuals named in the application to be genuinely responsible for the risk and compliance outcomes of the licensed entity.
Third – and this is the issue most directly tied to real business loss – operators sometimes begin custody operations before the authorisation is granted, on the assumption that an application in progress provides interim cover. It does not. Operating without a licence under the VASP Act is an offence. The FSC has authority to issue cease-and-desist notices, impose civil penalties, and refer cases for criminal prosecution. We have seen banking relationships terminated by correspondent banks upon discovery of unlicensed activity, even where the FSC had not yet taken formal action.
A common assumption in this space is that a single offshore licence is sufficient to serve clients globally. It is not. Each jurisdiction where clients reside, where marketing is directed, or where transfers are received may impose its own regulatory requirements. A BVI licence addresses BVI-regulated activity. It does not substitute for MiCA compliance for EU clients, for FCA registration for UK clients, or for the MAS licence required for Singapore-based activity.
A recent custody authorisation matter
In a recent BVI licensing engagement, a fund administrator seeking to expand into digital-asset custody for institutional clients approached us after its initial application had been returned as incomplete by the FSC. The administrator had submitted documentation prepared for an earlier – and unsuccessful – EU VASP registration attempt, without addressing the BVI FSC's specific requirements for key-management architecture disclosure. We conducted a full compliance documentation review, rebuilt the AML programme to align with the FSC's expectations under the VASP Act, and coordinated with the administrator's banking partner to ensure the institution's own due diligence requirements were addressed in parallel. The application was resubmitted as a complete package and moved through the FSC's substantive review without further requests for information. The administrator received its custody authorisation and banking confirmations in the same quarter.
Which operator profile should pursue BVI custody authorisation?
Different operator profiles reach different conclusions about whether the BVI is the right custody hub. The following outlines the three most common situations we encounter in practice.
Profile A – The offshore fund custodian. A BVI or Cayman-domiciled fund seeking a custody solution for its digital-asset portfolio is typically well-served by a BVI VASP licence. The common-law corporate framework, the proximity to the fund domicile, and the FSC's established relationship with offshore institutional structures make the BVI a natural home. The key risk is substance: the FSC will expect genuine operational presence, not a nominee structure. Timeline: measured in months from a complete application.
Profile B – The exchange seeking to add custody services. A digital-asset exchange already registered in another hub (Singapore, Malta, Lithuania) that wants to offer custody as a separate service line should assess whether it is more efficient to add custody to its existing licence in the home jurisdiction or to establish a BVI entity for the custody function. The answer turns on the home-jurisdiction regime's approach to combined licences and the banking strategy. Where the exchange's primary banking is in Asia-Pacific or the EU, a BVI sub-custodian may add complexity rather than solve it.
Profile C – The technology provider crossing into custody. A key-management technology provider that offers institutional clients a managed service with operational control over keys will frequently find, on analysis, that its product is a custody service under the VASP Act. The BVI licence provides a clean regulatory basis for that model. The risk profile here is reputational: institutional clients – particularly regulated funds – are increasing their due diligence on the regulatory status of their technology and custody providers. A licensed structure resolves that diligence question definitively.
Self-assessment: is your custody model within scope in the BVI?
The following questions are a practical screen, not legal advice. If you answer "yes" to any of them, a formal scoping analysis is warranted before you proceed.
- Does your BVI entity hold or control private keys on behalf of clients?
- Does your platform settle digital-asset transactions on behalf of third parties?
- Do you provide key-recovery or key-backup services under a managed arrangement?
- Do you act as a sub-custodian for a fund, exchange or institutional client?
- Do you maintain segregated wallets or accounts in the name of your BVI entity for client assets?
- Does your business model involve assuming liability for client digital assets under a custody agreement?
Answering "no" to all of the above is not conclusive. The FSC applies a functional analysis. An activity that does not facially match these descriptions may still constitute custody under the VASP Act if the economic reality of the arrangement places the operator in control of client assets.
Related at OBOLUS
- Licensing and registration for digital-asset businesses – the complete framework for structuring a multi-jurisdiction licence stack across operating, custody and payment layers.
- Crypto exchange setup in Liechtenstein – how the Liechtenstein Blockchain Act works for exchange operators seeking a European regulatory base.
- Tax treatment of tokens in Singapore – the IRAS approach to token classification, trading income and staking rewards for BVI-parented Singapore operations.
FAQ
How long does a crypto licence take to obtain?
Timeline varies by jurisdiction, application quality and regulator workload. In the BVI, a full VASP custody licence is typically measured in months from the date the FSC deems the application complete. Incomplete submissions are the most common cause of delay. Operators should build authorisation lead time into their product launch schedule and not begin regulated activity before the licence is granted.
Which jurisdiction is best for licensing my crypto business?
There is no universally optimal jurisdiction. The right licence hub depends on your client geography, banking relationships, capital structure and the specific activities you conduct. A BVI licence works well for fund-facing custody and offshore institutional structures. EU-facing businesses typically need a MiCA CASP authorisation. Asia-Pacific flows often require a Singapore MAS licence. Most sophisticated operations carry licences in more than one jurisdiction.
Do I need a separate custody licence?
Under the BVI VASP Act, custody is a defined regulated activity requiring its own authorisation – it is not automatically covered by a registration for another VASP activity such as exchange or brokerage. Many other regimes take the same position: MiCA treats custody as a distinct CASP service, and MAS distinguishes custody from payment services. If your business model involves safeguarding client assets, a scoped analysis of each relevant jurisdiction is necessary before you assume coverage.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence, banking and tax stack across operating, custody and payment layers before you commit – and we structure those workstreams as a single mandate rather than three disconnected engagements. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in VASP authorisation, offshore custody structures and multi-jurisdiction licence mapping for digital-asset businesses.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.